Summary by cubic

Fixes incomplete mitigation for GHSA-pmwg-cvhr-8vh7 by correctly detecting all loopback forms in shouldBypassProxy, ensuring NO_PROXY bypass applies to 127/8, ::1 variants, and IPv4-mapped IPv6. This prevents unintended proxying of local addresses and closes bypass gaps.

• Bug Fixes

  • Implemented robust loopback checks:
    • IPv4: entire 127.0.0.0/8 subnet.
    • IPv6: ::1, 0:0:0:0:0:0:0:1, and IPv4-mapped forms (e.g., ::ffff:127.0.0.1 and ::ffff:7f00:1 range).
  • Treat NO_PROXY loopback entries as cross-equivalent across IPv4/IPv6 forms, with port-aware matching.
  • Replaced broad hostname set with precise parsing to avoid false positives.

• Notes

  • Docs: Add a note in /docs/ about loopback handling and NO_PROXY equivalence across IPv4/IPv6, including port-specific behavior.
  • Testing: Added unit tests covering 127/8, IPv6 full-form and mapped variants, negative cases, and port matching.
  • Semantic version impact: Patch. Security fix with no API changes.

^{Written for commit 44c472a. Summary will update on new commits.}